% Chakram is a subproject of Hexena - Haskell Executable Analyser
% License:            GPL-3
% Maintainer:        Montez Fitzpatrick
% Stability:        Experimental
% Portability:        GHC
% Module:            Hexena.Internal.Constants

This module holds Constants

\begin{code}
module Hexena.Internal.Constants where

import Data.Word (Word32)

import Data.Tuple (swap)

-- * Little Endian Constants

iMAGE_DOS_SIGNATURE :: Word32          -- MZ
iMAGE_DOS_SIGNATURE = 0x5A4D           -- MZ
iMAGE_OS2_SIGNATURE :: Word32          -- NE
iMAGE_OS2_SIGNATURE = 0x454E           -- NE
iMAGE_OS2_SIGNATURE_LE :: Word32       -- LE
iMAGE_OS2_SIGNATURE_LE = 0x454C        -- LE
iMAGE_NT_SIGNATURE :: Word32           -- PE00
iMAGE_NT_SIGNATURE = 0x00004550        -- PE00
iMAGE_LX_SIGNATURE :: Word32         -- LX
iMAGE_LX_SIGNATURE = 0x584C             -- LX

-- * Big Endian Constants

iMAGE_DOS_SIGNATURE_be :: Word32     -- MZ Big-Endian
iMAGE_DOS_SIGNATURE_be = 0x4D5A      -- MZ Big-Endian
iMAGE_OS2_SIGNATURE_be :: Word32     -- NE Big-Endian
iMAGE_OS2_SIGNATURE_be = 0x454E      -- NE Big-Endian
iMAGE_OS2_SIGNATURE_LE_be :: Word32  -- LE Big-Endian
iMAGE_OS2_SIGNATURE_LE_be = 0x454C   -- LE Big-Endian
iMAGE_NT_SIGNATURE_be :: Word32      -- PE00 Big-Endian
iMAGE_NT_SIGNATURE_be = 0x50450000   -- PE00 Big-Endian

-- * File Header

iMAGE_SIZE_OF_IMAGE_DOS_HEADER :: Int
iMAGE_SIZE_OF_IMAGE_DOS_HEADER = 64 -- 64 Bytes

iMAGE_SIZEOF_FILE_HEADER :: Int
iMAGE_SIZEOF_FILE_HEADER = 20

-- | Image file characteristics
imageFileCharacteristics :: [(String, Word32)]
imageFileCharacteristics =
    [ ("IMAGE_FILE_RELOCS_STRIPPED", 0x0001)            -- Relocation info stripped from file.
    , ("IMAGE_FILE_EXECUTABLE_IMAGE", 0x0002)            -- File is executable  (i.e. no unresolved externel references).
    , ("IMAGE_FILE_LINE_NUMS_STRIPPED", 0x0004)            -- Line nunbers stripped from file.
    , ("IMAGE_FILE_LOCAL_SYMS_STRIPPED", 0x0008)        -- Local symbols stripped from file.
    , ("IMAGE_FILE_AGGRESIVE_WS_TRIM", 0x0010)            -- Agressively trim working set
    , ("IMAGE_FILE_LARGE_ADDRESS_AWARE", 0x0020)        -- App can handle >2gb addresses
    , ("IMAGE_FILE_16BIT_MACHINE", 0x0040)                -- 16 bit word machine.
    , ("IMAGE_FILE_BYTES_REVERSED_LO", 0x0080)            -- Bytes of machine word are reversed.
    , ("IMAGE_FILE_32BIT_MACHINE", 0x0100)                -- 32 bit word machine.
    , ("IMAGE_FILE_DEBUG_STRIPPED", 0x0200)                -- Debugging info stripped from file in .DBG file
    , ("IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP", 0x0400)    -- If Image is on removable media, copy and run from the swap file.
    , ("IMAGE_FILE_NET_RUN_FROM_SWAP", 0x0800)            -- If Image is on Net, copy and run from the swap file.
    , ("IMAGE_FILE_SYSTEM", 0x1000)                        -- System File.
    , ("IMAGE_FILE_DLL", 0x2000)                        -- File is a DLL.
    , ("IMAGE_FILE_UP_SYSTEM_ONLY", 0x4000)                -- File should only be run on a UP machine
    , ("IMAGE_FILE_BYTES_REVERSED_HI", 0x8000)            -- Bytes of machine word are reversed.
    ]

-- | The characteristics of the image with the Keys and Values Swapped.
imageFileCharacteristicsVK :: [(Word32, String)]
imageFileCharacteristicsVK = fmap swap imageFileCharacteristics

iMAGE_FILE_MACHINE_I386, iMAGE_FILE_MACHINE_AMD64 :: Word16
iMAGE_FILE_MACHINE_I386 = 0x014c         -- Intel 386.
iMAGE_FILE_MACHINE_AMD64 = 0x8664         -- AMD64 (K8)

imageFileArch :: [(String, Word16)]
imageFileArch =
    [ ("IMAGE_FILE_MACHINE_UNKNOWN", 0)
    , ("IMAGE_FILE_MACHINE_I386", 0x014c)         -- Intel 386.
    , ("IMAGE_FILE_MACHINE_R3000", 0x0162)      -- MIPS little-endian,", 0x160 big-endian
    , ("IMAGE_FILE_MACHINE_R4000", 0x0166)      -- MIPS little-endian
    , ("IMAGE_FILE_MACHINE_R10000", 0x0168)      -- MIPS little-endian
    , ("IMAGE_FILE_MACHINE_WCEMIPSV2", 0x0169)  -- MIPS little-endian WCE v2
    , ("IMAGE_FILE_MACHINE_ALPHA", 0x0184)      -- Alpha_AXP
    , ("IMAGE_FILE_MACHINE_SH3", 0x01a2)          -- SH3 little-endian
    , ("IMAGE_FILE_MACHINE_SH3DSP", 0x01a3)
    , ("IMAGE_FILE_MACHINE_SH3E", 0x01a4)          -- SH3E little-endian
    , ("IMAGE_FILE_MACHINE_SH4", 0x01a6)          -- SH4 little-endian
    , ("IMAGE_FILE_MACHINE_SH5", 0x01a8)          -- SH5
    , ("IMAGE_FILE_MACHINE_ARM", 0x01c0)          -- ARM Little-Endian
    , ("IMAGE_FILE_MACHINE_THUMB", 0x01c2)
    , ("IMAGE_FILE_MACHINE_AM33", 0x01d3)
    , ("IMAGE_FILE_MACHINE_POWERPC", 0x01F0)      -- IBM PowerPC Little-Endian
    , ("IMAGE_FILE_MACHINE_POWERPCFP", 0x01f1)
    , ("IMAGE_FILE_MACHINE_IA64", 0x0200)          -- Intel 64
    , ("IMAGE_FILE_MACHINE_MIPS16", 0x0266)      -- MIPS
    , ("IMAGE_FILE_MACHINE_ALPHA64", 0x0284)      -- ALPHA64
    , ("IMAGE_FILE_MACHINE_MIPSFPU", 0x0366)      -- MIPS
    , ("IMAGE_FILE_MACHINE_MIPSFPU16", 0x0466)  -- MIPS
    , ("IMAGE_FILE_MACHINE_AXP64", 0x0284)      -- IMAGE_FILE_MACHINE_ALPHA64
    , ("IMAGE_FILE_MACHINE_TRICORE", 0x0520)      -- Infineon
    , ("IMAGE_FILE_MACHINE_CEF", 0x0CEF)
    , ("IMAGE_FILE_MACHINE_EBC", 0x0EBC)          -- EFI Byte Code
    , ("IMAGE_FILE_MACHINE_AMD64", 0x8664)      -- AMD64 (K8)
    , ("IMAGE_FILE_MACHINE_M32R", 0x9041)          -- M32R little-endian
    , ("IMAGE_FILE_MACHINE_CEE", 0xC0EE)
    ]

imageFileArchVK :: [(Word16, String)]
imageFileArchVK = fmap swap imageFileArch

-- * Optional Header

iMAGE_NT_OPTIONAL_HDR32_MAGIC :: Word16
iMAGE_NT_OPTIONAL_HDR32_MAGIC = 0x10b
iMAGE_NT_OPTIONAL_HDR64_MAGIC :: Word16
iMAGE_NT_OPTIONAL_HDR64_MAGIC = 0x20b
iMAGE_ROM_OPTIONAL_HDR_MAGIC :: Word16
iMAGE_ROM_OPTIONAL_HDR_MAGIC = 0x107

-- ** Data Directory
mAX_NUMBEROF_DIRECTORY_ENTRIES :: Word32
mAX_NUMBEROF_DIRECTORY_ENTRIES = 16

-- | Subsystem values
imageSubSystem :: [(String, Int)]
imageSubSystem =
    [ ("IMAGE_SUBSYSTEM_UNKNOWN", 0)                  -- Unknown subsystem.
    , ("IMAGE_SUBSYSTEM_NATIVE", 1)                   -- Image doesn't require a subsystem.
    , ("IMAGE_SUBSYSTEM_WINDOWS_GUI", 2)              -- Image runs in the Windows GUI subsystem.
    , ("IMAGE_SUBSYSTEM_WINDOWS_CUI", 3)              -- Image runs in the Windows character subsystem.
    , ("IMAGE_SUBSYSTEM_OS2_CUI", 5)                  -- image runs in the OS/2 character subsystem.
    , ("IMAGE_SUBSYSTEM_POSIX_CUI", 7)                -- image runs in the Posix character subsystem.
    , ("IMAGE_SUBSYSTEM_NATIVE_WINDOWS", 8)           -- image is a native Win9x driver.
    , ("IMAGE_SUBSYSTEM_WINDOWS_CE_GUI", 9)           -- Image runs in the Windows CE subsystem.
    , ("IMAGE_SUBSYSTEM_EFI_APPLICATION", 10)
    , ("IMAGE_SUBSYSTEM_EFI_BOOT_SERVICE_DRIVER", 11)
    , ("IMAGE_SUBSYSTEM_EFI_RUNTIME_DRIVER", 12)
    , ("IMAGE_SUBSYSTEM_EFI_ROM", 13)
    , ("IMAGE_SUBSYSTEM_XBOX", 14)
    , ("IMAGE_SUBSYSTEM_WINDOWS_BOOT_APPLICATION", 16)
    ]

-- | Subsystem values reversed
imageSubSystemVK :: [(Int, String)]
imageSubSystemVK = fmap swap imageSubSystem

-- * Section Header

iMAGE_SIZEOF_SECTION_HEADER :: Int
iMAGE_SIZEOF_SECTION_HEADER = 40

-- | Section Characteristics
imageSectionCharacteristics :: [(String, Word32)]
imageSectionCharacteristics =
    [ ("IMAGE_SCN_TYPE_REG",                 0x00000000) -- Reserved.
    , ("IMAGE_SCN_TYPE_DSECT",               0x00000001) -- Reserved.
    , ("IMAGE_SCN_TYPE_NOLOAD",              0x00000002) -- Reserved.
    , ("IMAGE_SCN_TYPE_GROUP",               0x00000004) -- Reserved.
    , ("IMAGE_SCN_TYPE_NO_PAD",              0x00000008) -- Reserved.
    , ("IMAGE_SCN_TYPE_COPY",                0x00000010) -- Reserved.
    , ("IMAGE_SCN_CNT_CODE",                 0x00000020) -- Section contains code.
    , ("IMAGE_SCN_CNT_INITIALIZED_DATA",     0x00000040) -- Section contains initialized data.
    , ("IMAGE_SCN_CNT_UNINITIALIZED_DATA",   0x00000080) -- Section contains uninitialized data.
    , ("IMAGE_SCN_LNK_OTHER",                0x00000100) -- Reserved.
    , ("IMAGE_SCN_LNK_INFO",                 0x00000200) -- Section contains comments or some other type of information.
    , ("IMAGE_SCN_TYPE_OVER",                0x00000400) -- Reserved.
    , ("IMAGE_SCN_LNK_REMOVE",               0x00000800) -- Section contents will not become part of image.
    , ("IMAGE_SCN_LNK_COMDAT",               0x00001000) -- Section contents comdat.
    , ("Reserved_AT_2000",                   0x00002000) -- Reserved.
    , ("IMAGE_SCN_MEM_PROTECTED",               0x00004000) -- Obsolete
    , ("IMAGE_SCN_NO_DEFER_SPEC_EXC",        0x00004000) -- Reset speculative exceptions handling bits in the TLB entries for this section.
    , ("IMAGE_SCN_GPREL",                    0x00008000) -- Section content can be accessed relative to GP
    , ("IMAGE_SCN_MEM_FARDATA",              0x00008000)
    , ("IMAGE_SCN_MEM_SYSHEAP",                 0x00010000) -- Obsolete 
    , ("IMAGE_SCN_MEM_PURGEABLE",            0x00020000)
    , ("IMAGE_SCN_MEM_16BIT",                0x00020000)
    , ("IMAGE_SCN_MEM_LOCKED",               0x00040000)
    , ("IMAGE_SCN_MEM_PRELOAD",              0x00080000)
    , ("IMAGE_SCN_ALIGN_1BYTES",             0x00100000) --
    , ("IMAGE_SCN_ALIGN_2BYTES",             0x00200000) --
    , ("IMAGE_SCN_ALIGN_4BYTES",             0x00300000) --
    , ("IMAGE_SCN_ALIGN_8BYTES",             0x00400000) --
    , ("IMAGE_SCN_ALIGN_16BYTES",            0x00500000) -- Default alignment if no others are specified.
    , ("IMAGE_SCN_ALIGN_32BYTES",            0x00600000) --
    , ("IMAGE_SCN_ALIGN_64BYTES",            0x00700000) --
    , ("IMAGE_SCN_ALIGN_128BYTES",           0x00800000) --
    , ("IMAGE_SCN_ALIGN_256BYTES",           0x00900000) --
    , ("IMAGE_SCN_ALIGN_512BYTES",           0x00A00000) --
    , ("IMAGE_SCN_ALIGN_1024BYTES",          0x00B00000) --
    , ("IMAGE_SCN_ALIGN_2048BYTES",          0x00C00000) --
    , ("IMAGE_SCN_ALIGN_4096BYTES",          0x00D00000) --
    , ("IMAGE_SCN_ALIGN_8192BYTES",          0x00E00000) --
    , ("IMAGE_SCN_ALIGN_MASK",               0x00F00000)
    , ("IMAGE_SCN_LNK_NRELOC_OVFL",          0x01000000) -- Section contains extended relocations.
    , ("IMAGE_SCN_MEM_DISCARDABLE",          0x02000000) -- Section can be discarded.
    , ("IMAGE_SCN_MEM_NOT_CACHED",           0x04000000) -- Section is not cachable.
    , ("IMAGE_SCN_MEM_NOT_PAGED",            0x08000000) -- Section is not pageable.
    , ("IMAGE_SCN_MEM_SHARED",               0x10000000) -- Section is shareable.
    , ("IMAGE_SCN_MEM_EXECUTE",              0x20000000) -- Section is executable.
    , ("IMAGE_SCN_MEM_READ",                 0x40000000) -- Section is readable.
    , ("IMAGE_SCN_MEM_WRITE",                0x80000000) -- Section is writeable.
    ]

-- | Section Characteristics Reversed
imageSectionCharacteristicsVK :: [(Word32, String)]
imageSectionCharacteristicsVK = fmap swap imageSectionCharacteristics
 
-- * Attribute Certificate (Security) Table Section
--  Applies to Images Only
wIN_CERT_REVISION_1_0 :: Word16 -- Only supposed to be used for verifying legacy Authenticode signatures
wIN_CERT_REVISION_1_0 = 0x0100
wIN_CERT_REVISION_2_0 :: Word16
wIN_CERT_REVISION_2_0 = 0x0200

winCertificateType :: [(String, Word16)]
winCertificateType =
    [ ("WIN_CERT_TYPE_X509",                0x0001) -- [Not Supported] X.509 Certificate 
    , ("WIN_CERT_TYPE_PKCS_SIGNED_DATA",    0x0002) -- PKCS#7 SignedData structure
    , ("WIN_CERT_TYPE_RESERVED_1",            0x0003) -- Reserved
    , ("WIN_CERT_TYPE_TS_STACK_SIGNED",        0x0004) -- [Not Supported] Terminal Server Protocol Stack Certificate Signing
\end{code}